CVE-2024-22417

{"id": "CVE-2024-22417", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-01-23T18:15:18.860", "references": [{"url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L476", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L484C6-L484C7", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a `GET` request on lines 339-343 in `requests.py`. The returned contents of the URL are then passed to and reflected back to the user in the `send_file` function on line 484, together with the user-controlled `src_type`, which allows the attacker to control the HTTP response content type leading to a cross-site scripting vulnerability. An attacker could craft a special URL to point to a malicious website and send the link to a victim. The fact that the link would contain a trusted domain (e.g. from one of public Whoogle instances) could be used to trick the user into clicking the link. The malicious website could, for example, be a copy of a real website, meant to steal a person\u2019s credentials to the website, or trick that person in another way. Version 0.8.4 contains a patch for this issue."}, {"lang": "es", "value": "Whoogle Search es un metabuscador autohospedado. En las versiones 0.8.3 y anteriores, el m\u00e9todo `element` en `app/routes.py` no valida las variables `src_type` y `element_url` controladas por el usuario y las pasa al m\u00e9todo `send` que env\u00eda un `GET `solicitud en las l\u00edneas 339-343 en `requests.py`. El contenido devuelto de la URL luego se pasa y se refleja al usuario en la funci\u00f3n `send_file` en la l\u00ednea 484, junto con el `src_type` controlado por el usuario, que permite al atacante controlar el tipo de contenido de la respuesta HTTP que conduce a una vulnerabilidad de cross-site scripting. Un atacante podr\u00eda crear una URL especial para apuntar a un sitio web malicioso y enviar el enlace a una v\u00edctima. El hecho de que el enlace contenga un dominio confiable (por ejemplo, de una de las instancias p\u00fablicas de Whoogle) podr\u00eda usarse para enga\u00f1ar al usuario para que haga clic en el enlace. El sitio web malicioso podr\u00eda, por ejemplo, ser una copia de un sitio web real, destinado a robar. las credenciales de una persona para el sitio web, o enga\u00f1ar a esa persona de otra manera. La versi\u00f3n 0.8.4 contiene un parche para este problema."}], "lastModified": "2024-02-15T03:17:08.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:benbusby:whoogle_search:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3DA218E-B891-4381-97E4-F0F1147E6309", "versionEndExcluding": "0.8.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}